feat: add contacts phase 2, advanced search, vacation responder, Docker & TOTP 2FA

- Contact groups/lists, vCard import/export (RFC 6350), bulk operations
- Advanced search with JMAP filter panel, search chips, cross-mailbox queries
- Vacation responder with JMAP VacationResponse, settings tab, sidebar indicator
- TOTP two-factor authentication support
- Docker multi-stage build with standalone output and docker-compose
- CSP Report-Only headers and security headers via proxy middleware
- Virtual scrolling for large email lists
- Structured server-side logger (text/JSON, configurable level)
- 450+ tests (contacts, vCard, threads, headers, identity, components)
- Playwright E2E framework setup
- Updated README and ROADMAP with all new features

.env.example

@@ -1,9 +1,42 @@
 # JMAP Webmail Configuration
 # Copy this file to .env.local and fill in your values
 
+# =============================================================================
+# Runtime Configuration (recommended for Docker)
+# These are read at request time, allowing post-build configuration
+# =============================================================================
+
 # App name displayed in the UI
-NEXT_PUBLIC_APP_NAME=JMAP Webmail
+APP_NAME=JMAP Webmail
 
 # JMAP server URL (required)
 # This is the URL of your JMAP-compatible mail server
-NEXT_PUBLIC_JMAP_SERVER_URL=https://your-jmap-server.com
+JMAP_SERVER_URL=https://your-jmap-server.com
+
+# =============================================================================
+# Build-time Configuration (legacy, still supported as fallback)
+# These are baked into the bundle at build time
+# =============================================================================
+
+# NEXT_PUBLIC_APP_NAME=JMAP Webmail
+# NEXT_PUBLIC_JMAP_SERVER_URL=https://your-jmap-server.com
+
+# =============================================================================
+# Logging Configuration
+# =============================================================================
+
+# Log format: "text" (colored, human-readable) or "json" (structured, for log aggregation)
+LOG_FORMAT=text
+
+# Log level: "error", "warn", "info", or "debug"
+LOG_LEVEL=info
+
+# =============================================================================
+# Docker Configuration
+# =============================================================================
+# When running with Docker, set these in .env.local:
+#   APP_NAME=My Webmail
+#   JMAP_SERVER_URL=https://mail.example.com
+#
+# Then run:
+#   docker compose up -d